Mailpit's HTML Check API prior to version 1.30.0 uses an HTTP client that lacks IP allowlisting when fetching CSS resources, allowing SSRF attacks. Although a size cap and content-type checks were added in version 1.28.3, the client still permits requests to loopback, private, link-local, and reserved IP ranges if the response is HTTP 200 with a 'text/css' content-type. Redirects are followed without IP filtering, enabling an attacker-controlled public site to redirect requests into internal networks invisibly. The vulnerability is exploitable without authentication by sending a malicious HTML email and then calling the /api/v1/message/{id}/html-check endpoint. The fix in version 1.30.0 updates the HTTP client to include IP allowlisting, mitigating the SSRF risk.

An unauthenticated attacker can exploit this SSRF vulnerability to make the mailpit server send HTTP requests to internal or private network addresses, potentially accessing internal services or resources not otherwise exposed. The vulnerability does not directly disclose data but can be used to interact with internal systems, causing information leakage or indirect impact. The CVSS score is 5.8 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

Version 1.30.0 of mailpit contains an updated fix that adds IP allowlisting to the HTTP client used in the HTML Check API, effectively mitigating this SSRF vulnerability. Users should upgrade to mailpit version 1.30.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the mention of version 1.30.0 containing the fix; users should verify with the vendor advisory for the latest guidance.